fix: crash-proofing + small robustness fixes

- pool.js: add pool.on('error') handler — an idle-client error (DB restart /
  .215 failover) previously crashed the process (no 'error' listener → throw)
- context tool: project a SAFE_COLUMNS allow-list for resources (never the
  monitoring/metadata JSON blobs); also add 'resource' to TABLE (was unhandled)
- applyPendingChange: guard the 'upsert' arm so a non-upsertable entity_type
  fails with a clear ValidationError instead of a bare TypeError

Tests: pool_error, context (resource case), pending_extended_actions (guard).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/db/pool_error.test.js

@@ -0,0 +1,12 @@
+import { describe, it, expect } from 'vitest';
+import { pool } from '../../lib/db/pool.js';
+
+// A pg.Pool emits 'error' when an *idle* pooled client errors (DB restart,
+// replication failover). With no 'error' listener, EventEmitter throws and the
+// whole process crashes. The pool must register a handler.
+describe('db pool error handling', () => {
+  it('has an error listener so an idle-client error never crashes the process', () => {
+    expect(pool.listenerCount('error')).toBeGreaterThan(0);
+    expect(() => pool.emit('error', new Error('simulated idle-client error'), null)).not.toThrow();
+  });
+});